Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Aaron Conole <aconole@redhat.com>
To:     netdev@vger.kernel.org
Cc:     Pravin B Shelar <pshelar@ovn.org>,
        "David S . Miller" <davem@davemloft.net>,
        Jamal Hadi Salim <jhs@mojatatu.com>,
        Cong Wang <xiyou.wangcong@gmail.com>,
        Jiri Pirko <jiri@resnulli.us>, dev@openvswitch.org,
        linux-kernel@vger.kernel.org
Subject: [PATCH net 2/2] act_ct: support asymmetric conntrack
Date:   Fri,  8 Nov 2019 16:07:14 -0500
Message-Id: <20191108210714.12426-2-aconole@redhat.com>
In-Reply-To: <20191108210714.12426-1-aconole@redhat.com>
References: <20191108210714.12426-1-aconole@redhat.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=WINDOWS-1252
Content-Transfer-Encoding: quoted-printable
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

The act_ct TC module shares a common conntrack and NAT infrastructure
exposed via netfilter.  It's possible that a packet needs both SNAT and
DNAT manipulation, due to e.g. tuple collision.  Netfilter can support
this because it runs through the NAT table twice - once on ingress and
again after egress.  The act_ct action doesn't have such capability.

Like netfilter hook infrastructure, we should run through NAT twice to
keep the symmetry.

Fixes: b57dc7c13ea9 ("net/sched: Introduce action ct")

Signed-off-by: Aaron Conole <aconole@redhat.com>
---
 net/sched/act_ct.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c
index fcc46025e790..f3232a00970f 100644
--- a/net/sched/act_ct.c
+++ b/net/sched/act_ct.c
@@ -329,6 +329,7 @@ static int tcf_ct_act_nat(struct sk_buff *skb,
 =09=09=09  bool commit)
 {
 #if IS_ENABLED(CONFIG_NF_NAT)
+=09int err;
 =09enum nf_nat_manip_type maniptype;
=20
 =09if (!(ct_action & TCA_CT_ACT_NAT))
@@ -359,7 +360,17 @@ static int tcf_ct_act_nat(struct sk_buff *skb,
 =09=09return NF_ACCEPT;
 =09}
=20
-=09return ct_nat_execute(skb, ct, ctinfo, range, maniptype);
+=09err =3D ct_nat_execute(skb, ct, ctinfo, range, maniptype);
+=09if (err =3D=3D NF_ACCEPT &&
+=09    ct->status & IPS_SRC_NAT && ct->status & IPS_DST_NAT) {
+=09=09if (maniptype =3D=3D NF_NAT_MANIP_SRC)
+=09=09=09maniptype =3D NF_NAT_MANIP_DST;
+=09=09else
+=09=09=09maniptype =3D NF_NAT_MANIP_SRC;
+
+=09=09err =3D ct_nat_execute(skb, ct, ctinfo, range, maniptype);
+=09}
+=09return err;
 #else
 =09return NF_ACCEPT;
 #endif
--=20
2.21.0